Personal data processing instruction

This Instruction is part of the public offer (Terms of Service) of Tuqo (section 17). It describes how Tuqo processes the personal data of visitors of the User's sites: those who open the User's site, submit forms, sign in to a gated site or pay for access, as well as other persons whose data the User places or processes using the Service themselves (for example, in site files or in the list of sign-in addresses; together, the “data subjects”). The User (the site owner) is the operator of this data; Tuqo is the person processing it on the User's instruction (Part 3 of Article 6 of Federal Law No. 152-FZ “On Personal Data”). Acceptance of the offer constitutes both giving and accepting the Instruction; nothing needs to be signed separately.

The document is written so that it can be quoted in your personal data processing policy and in your notification to Roskomnadzor (the Russian data protection authority); see section 8.

1. Parties and roles

Operator (the User): the person who has hosted a site on Tuqo. The Operator determines the purposes of processing the data subjects' data, its scope and legal grounds, and is responsible to the data subjects and to the authorized body.

Processor (Tuqo): Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov, TIN (INN) 262517638904, OGRNIP 312265133100116. It processes the data subjects' data solely for the purposes and to the extent of the Instruction, without determining the purposes of processing and without using the data in its own interests.

Two roles of one platform. With respect to the data subjects' data, Tuqo is a processor under this Instruction. With respect to technical access logs, abuse prevention, traffic accounting and settlements with the User under their plan, Tuqo acts as an independent operator; this is described in the Privacy Policy.

2. Subject of the instruction

Processing is automated and takes place in the following scenarios:

List of actions in all scenarios: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, provision of access (serving the site content in the access mode chosen by the User), anonymization, blocking, deletion, destruction. Transfer to third parties: only in the cases set out in section 4 at the User's choice, and in cases expressly provided for by law.

Not intended for processing special categories of personal data (health, beliefs, intimate life, etc.), biometric data or data of minors. The User may not collect such data using the Service, and visitors may not enter it. The Service's information system is not attested, and certified information security tools are not used.

Site content. The Processor does not view, analyze or extract personal data from the content of the User's sites, except where this is necessary: to respond to the User's support request, to the extent of that request; for automated checks of deploys for malicious code, phishing and violations of the Service's rules; to consider a complaint or a demand of an authorized body. The legal ground for placing such data, including the data subject's consent to its dissemination (Article 10.1 of Federal Law No. 152-FZ), is ensured by the User.

3. Processor's obligations

1. Process data only for the purposes and to the extent set out in section 2, following the User's documented instructions, namely the settings of the User's site in the control panel.
2. Maintain confidentiality; not disclose data to third parties except in cases expressly provided for by law or by this Instruction.
3. Take the measures provided for by Article 19 of Federal Law No. 152-FZ: encryption in transit (HTTPS), access control, storing secrets and keys in encrypted form, pseudonymization of blocks, access logging.
4. Store data in the territory of the Russian Federation; not carry out cross-border transfer, except for the delivery of submissions and the check of visitors' subscriptions via the Telegram messenger, whose operator is located abroad, if the User has enabled them: they are performed on the User's instruction as the operator (section 5).
5. Notify the User of an incident affecting the data subjects' data at the email address of the User's account within 24 hours of its detection, with the information known at that moment, and supplement the notification once the investigation is complete. Notifying the authorized body and the data subjects is the User's obligation as the operator; the Processor provides the information needed for this.
6. Forward data subjects' requests (access, correction, deletion, withdrawal of consent) received by Tuqo to the User within 3 business days, without passing the requester's personal data to any other persons; it is the User who answers the requester.
7. Destroy data: when the User deletes a member or an address from the list, in the production system immediately; when the User deletes a site, once the period during which it can be restored from the trash has expired (24 hours; 7 days if the site was removed for non-payment); in backups within 30 days at most of deletion from the production system (backups are destroyed automatically; until destruction, the data in them is blocked and used only to restore the Service after a failure, and when restoring from a backup, previously deleted data is deleted again); upon a separate request of the User, within 30 days at most; upon termination of the contract, within the periods set out in the Privacy Policy. Payment records: after 3 years from the payment date.
8. At the User's request, provide information about the protection measures taken and about infrastructure providers, no more than once per quarter.

4. Infrastructure and third parties

Processing under this Instruction is carried out by the Processor itself using leased computing infrastructure located in the Russian Federation. The infrastructure providers provide the Processor with servers and storage; they do not process personal data on instruction, have no access to the contents other than technological access and do not use it for their own purposes. The Processor is liable to the User for processing on this infrastructure.

• TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД», Timeweb Cloud; TIN 7810945525, OGRN 1227800052215; office 605, 7 Universitetskaya St., Innopolis, Republic of Tatarstan, 420500): servers, databases and object storage for site files in data centers in Moscow and Saint Petersburg;
• Cloud Technologies LLC (ООО «Облачные технологии», Cloud.ru; TIN 7736279160, OGRN 5167746080057; room 1.207, 23 Vavilova St., bldg. 1, Moscow, 117312): storage of backups: database backups in encrypted form, backups of site files in closed storage without public access; backups are destroyed automatically within the periods set out in section 3.

Data is transferred to other persons only at the User's choice: to the User's payment provider (T-Bank or YooKassa) in the “Paid access” mode, which processes the buyer's data under its agreement with the User as an independent operator, the Processor only passing it the information needed for the payment and the receipt; and to the recipients of submissions and notifications, by email and to the Telegram and MAX messengers connected by the User themselves. These persons are not subprocessors of the Processor; messages are kept by the recipient under the rules of the services chosen by the User.

The Service's emails (sign-in codes, notifications, auto-replies on behalf of sites) are sent from the Processor's own mail server; no third-party email service is used.

The Processor may engage infrastructure providers and persons processing data on its instruction without the User's approval, provided that the data is stored in the Russian Federation and that they comply with confidentiality and protection requirements no lower than those established by this Instruction. The Processor is liable to the User for their actions. The current list of providers is given in this section and in the Privacy Policy.

5. Operator's (User's) obligations

1. Have a legal ground for processing the data subjects' data and confirm it at the Processor's request.
2. Inform visitors about the processing: publish their own personal data processing policy on the site and, for sign-up or payment, their own documents (offer, terms); the Service shows them on the login screen and records consent to them. Ready-made templates are available from the generator in the control panel; they are recommendations only.
3. Decide independently whether to request visitors' consents, which items, in what way and with which texts (offer, clause 17.1a): the consent block and the Service's universal texts are a tool and do not shift the operator's obligations to the Processor. The universal texts are provided “as is”: the User checks that they are applicable and that the User's details in them are correct; the content of the User's own documents and naming the Processor in them are the User's responsibility. The User keeps the evidence of consent (Part 3 of Article 9 of Federal Law No. 152-FZ) themselves, including by exporting the consent log; the Processor keeps the log for the periods set out in section 2.
4. Choose the recipients of notifications about access mode events independently and decide whether to include visitors' data in them; when sending such data to the recipients' addresses and messengers, the Processor acts on the User's instruction.
5. State processing on instruction and the processor in the Roskomnadzor notification (section 8), if the User is obliged to file a notification.
6. Use the data of members and buyers only to provide access, fulfil obligations and handle requests; send advertising mailings only on the basis of separate consent obtained by the User independently (Federal Law No. 38-FZ “On Advertising”). The Service sends visitors only service messages: sign-in codes, notifications about access status and about payment.
7. Respond to requests from visitors and buyers; not collect, using the Service, the data listed in section 2 as not intended for processing.
8. Decide independently whether to place personal data in the site content and which access mode to set for it. Placing personal data of third parties on a site without restricting access is the User's decision and responsibility; the Service does not check the content.
9. The User enables delivery of submissions and notifications to Telegram, the check of visitors' subscriptions via Telegram and requesting consents in the Telegram bot themselves; by enabling them, the User instructs the Processor to transfer to Telegram the contents of submissions and notifications and the information needed to check the subscription and to request consents. This is a cross-border transfer of personal data, and the User performs the operator's obligations under Article 12 of Federal Law No. 152-FZ (notifying the authorized body, informing visitors) independently; the Processor is not the operator of such transfer. A submission is first stored in the Service's database in the Russian Federation, and a copy of it is sent to Telegram.
10. Bear sole responsibility towards the data subjects and the authorized body for the lawfulness of processing; compensate the Processor for losses arising from a breach of these obligations.

6. Liability

The Processor is liable to the User for a breach of the obligations in section 3 within the limits set by the offer (section 12). The Processor is not liable for the lawfulness of processing, the existence of grounds and consents, the scope of the data collected or the content of the User's documents.

7. Term

The Instruction remains in effect for the term of the contract under the offer. When the User deletes an account or a site, processing of the corresponding data stops and the data is destroyed as set out in section 3.

8. Text for your policy and the Roskomnadzor notification

A paragraph you can include in your site's personal data processing policy:

“For placing the site, receiving submissions, and signing up and signing in visitors, the Operator entrusts the processing of personal data to Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov (TIN (INN) 262517638904, the Tuqo service, https://tuqo.ru) to the extent necessary for the site to work: storing the materials placed on the site, the email address, name and snapshot of consents, sending sign-in codes and service notifications on behalf of the site, keeping technical logs. The terms of processing on instruction: https://tuqo.ru/legal/dpa/. The data is stored in the territory of the Russian Federation.”

Translator's note: if your policy is in Russian, use the Russian wording of this paragraph from the original (in Russian); the processor's name in Russian is Индивидуальный предприниматель Антонов Александр Викторович.

In the Roskomnadzor notification (if you are obliged to file one), state “transfer” as one of the processing methods and name the processor acting on instruction: Individual entrepreneur (sole proprietor) Aleksandr Viktorovich Antonov (Индивидуальный предприниматель Антонов Александр Викторович), TIN (INN) 262517638904; place of processing: the data centers of the infrastructure provider TIMEWEB.CLOUD LLC (ООО «ТАЙМВЭБ.КЛАУД», Timeweb Cloud) in Moscow and Saint Petersburg; backups: Cloud Technologies LLC (ООО «Облачные технологии», Cloud.ru), Russian Federation. If you have enabled delivery of submissions or the subscription check via Telegram, state the cross-border transfer to Telegram in your policy and notification as well: the phrase “the data is stored in the territory of the Russian Federation” in the paragraph above must then mention it.

9. Related documents

Public offer (Terms of Service) (sections 17–18), Privacy Policy, Tuqo terms for site visitors, Cookie Policy.